[PATCH 2/4] dnp3: reduce flood threshold to 32 and make configurable
authorJason Ish <jason.ish@oisf.net>
Tue, 6 Jan 2026 17:06:40 +0000 (11:06 -0600)
committerAndreas Dolp <dev@andreas-dolp.de>
Sun, 22 Feb 2026 12:28:52 +0000 (13:28 +0100)
commit0a48413eddaf53884abd798b4f20b8de3ff9eb87
treedbccc9491c5fc0a4c865d517e57403187e5b295f
parent33c884311d118b083f1be49421b1b6387a3a6462
[PATCH 2/4] dnp3: reduce flood threshold to 32 and make configurable

Lower the number of unreplied requests from 500 to 32 to consider a
flood. At the very least this is an anomaly given the DNP3 spec mentions
that DNP3 should only have one outstanding request at a time, with an
exception for unsolicited responses, so in practice no more than 2
should be seen.

Additionally make this value configurable by introducing the max-tx
parameter.

Ticket: #8181
(cherry picked from commit a16f087b93be1ff2f2edf47371866ad9b28593c1)

Origin: upstream, https://github.com/OISF/suricata/commit/635af8dc8be09667689be71d781912718ca1aa49.patch
Bug: https://redmine.openinfosecfoundation.org/issues/8181
Subject: Upstream fix for CVE-2026-22259 part 2

Gbp-Pq: Name CVE-2026-22259_2.patch
doc/userguide/upgrade.rst
src/app-layer-dnp3.c
suricata.yaml.in